Many companies and other organizations operate computer networks that interconnect numerous computing systems to support their operations. For example, data centers housing significant numbers of interconnected computing systems have become commonplace, such as private data centers that are operated by and on behalf of a single organization, and public data centers that are operated by entities as businesses to provide computing resources to customers. Some public data center operators provide network access, power, and secure installation facilities for hardware owned by various customers, while other public data center operators provide “full service” facilities that also include hardware resources made available for use by their customers.
The advent of virtualization technologies for commodity hardware has provided benefits with respect to managing large-scale computing resources for many customers with diverse needs, allowing various computing resources to be efficiently and securely shared by multiple customers. For example, virtualization technologies may allow a single physical computing machine to be shared among multiple users by providing each user with one or more virtual machines hosted by the single physical computing machine. Each virtual machine can be thought of as a software simulation acting as a distinct logical computing system that provides users with the illusion that they are the sole operators and administrators of a given hardware computing resource, while also providing application isolation and security among the various virtual machines. Furthermore, some virtualization technologies are capable of providing virtual resources that span two or more physical resources, such as a single virtual machine with multiple virtual processors that spans multiple distinct physical computing systems. In some cases providers of virtual computing services set up large networks that may logically span several geographical regions or even countries, and may include numerous data centers with varying levels of services and facilities available, utilized together to provide a unified set of services to their end customers.
In some data centers that have been set up to provide virtualized computing and/or storage facilities to external customers, a set of resources at the data center may be dynamically divided into resource pools, with each pool being made available for exclusive use by a given customer for designated periods of time. In one scenario, a virtual isolated network comprising numerous compute instances and/or other devices may be set up for a customer at a provider network, and the customer may be granted substantial networking configuration flexibility for the isolated virtual network. For example, customers may assign IP addresses of their choice within the isolated virtual network, set up subnets and routes, and so on, in a manner very similar to the way that network configuration settings could be selected at a customer-owned facility.
In some data centers that have been set up to provide virtualized computing and/or storage facilities to external customers, requests for access to virtual computing resources may originate from a wide variety of devices—desktop personal computers, laptops, client-office servers, tablets, smart phones and the like. These devices may use either long-lasting network links (e.g., using a client office network with a T1 connection) to communicate with their proximate private network and/or the public Internet, or they may have transient connectivity (e.g., in the case where the customer uses a mobile smart phone). The proximate networks to which the customer devices are directly connected may in turn route request traffic to the provider network's data centers over a wide variety of public paths, such as the public Internet. Such public paths in many cases may have somewhat unpredictable performance, reliability and security characteristics.
Furthermore, some paths between a customer device and a provider network's data center over a public network, such as the Internet, may provide enhanced security, such as encryption. However, encrypted traffic may be decrypted after entering a provider network. The decrypted traffic may then be routed through the provider network to a customer's virtual isolated network within the provider network along with other traffic of other customers of the provider network. Such arrangements involving encrypted paths over public networks and decrypted traffic flow within a provider to a customer's isolated virtual network may not satisfy some customers' requirements for security, network performance, and reliability.
While embodiments are described herein by way of example for several embodiments and illustrative drawings, those skilled in the art will recognize that embodiments are not limited to the embodiments or drawings described. It should be understood, that the drawings and detailed description thereto are not intended to limit embodiments to the particular form disclosed, but on the contrary, the intention is to cover all modifications, equivalents and alternatives falling within the spirit and scope as defined by the appended claims. The headings used herein are for organizational purposes only and are not meant to be used to limit the scope of the description or the claims. As used throughout this application, the word “may” is used in a permissive sense (i.e., meaning having the potential to), rather than the mandatory sense (i.e., meaning must). Similarly, the words “include,” “including,” and “includes” mean including, but not limited to.